First commit

gitlab-selfhosted/nginx/Dockerfile

@@ -0,0 +1,9 @@
+FROM nginx:1.13
+
+ENV DOMAIN="todevnull.com" HUB_INTERNAL="http://jupyter:80" LAB_INTERNAL="gitlab:80" REGISTRY_INTERNAL="gitlab:5000"
+
+COPY init.sh /
+COPY snippets/ /etc/nginx/snippets/
+COPY conf.d /etc/nginx/conf.d/
+
+CMD /init.sh

gitlab-selfhosted/nginx/conf.d/hub.conf.template

@@ -0,0 +1,54 @@
+server {
+	listen 80;
+
+	access_log /var/log/nginx/hub.access.log;
+# add Strict-Transport-Security to prevent man in the middle attacks
+
+   server_name hub.${DOMAIN};
+   
+   root /var/www/html/ ;
+
+   include /etc/nginx/snippets/letsencrypt.conf;
+
+   location / {
+       return 301 https://$host$request_uri;
+   }
+
+
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name hub.${DOMAIN} ; 
+
+    access_log /var/log/nginx/hub.access.log;
+    error_log /var/log/nginx/hub.error.log;
+    # add Strict-Transport-Security to prevent man in the middle attacks
+    #add_header Strict-Transport-Security "max-age=31536000"; 
+    client_max_body_size 100M;
+
+    ssl_certificate /ssl/certs/nginx.crt;
+    ssl_certificate_key /ssl/private/nginx.key;
+   
+	location / {
+		proxy_set_header        Host $host;
+		proxy_set_header        X-Real-IP $remote_addr;
+		proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header        X-Forwarded-Proto $scheme;
+
+		proxy_pass ${HUB_INTERNAL};
+	}
+
+    location ~* /user/([a-zA-Z0-9]+)/(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/? {
+
+        proxy_set_header      Host $host;
+        # websocket support
+        proxy_http_version    1.1;
+        proxy_set_header      Upgrade "websocket";
+        proxy_set_header      Connection "Upgrade";
+
+        proxy_pass ${HUB_INTERNAL};
+    }
+}

gitlab-selfhosted/nginx/conf.d/lab.conf.template

@@ -0,0 +1,79 @@
+server {
+   listen 80;
+
+   server_name lab.${DOMAIN} chat.${DOMAIN};
+   
+   root /var/www/html/ ;
+
+   include /etc/nginx/snippets/letsencrypt.conf;
+
+   location / {
+       return 301 https://$host$request_uri;
+   }
+
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name lab.${DOMAIN} chat.${DOMAIN} ;    
+
+    access_log /var/log/nginx/gitlab.access.log;
+    error_log /var/log/nginx/gitlab.error.log;
+    # add Strict-Transport-Security to prevent man in the middle attacks
+    #add_header Strict-Transport-Security "max-age=31536000"; 
+    ssl_certificate /ssl/certs/nginx.crt;
+    ssl_certificate_key /ssl/private/nginx.key;
+
+    root /var/www/html/ ;
+
+   
+    location / {
+      client_max_body_size 0;
+      proxy_set_header        Host $host;
+      proxy_set_header        X-Real-IP $remote_addr;
+      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header        X-Forwarded-Proto $scheme;
+  
+      proxy_pass ${LAB_INTERNAL} ;
+    }
+
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+
+    server_name registry.${DOMAIN} ;    
+
+    access_log /var/log/nginx/gitlab-registry.access.log;
+    error_log /var/log/nginx/gitlab-registry.error.log;
+    # add Strict-Transport-Security to prevent man in the middle attacks
+    #add_header Strict-Transport-Security "max-age=31536000"; 
+    # disable any limits to avoid HTTP 413 for large image uploads
+    client_max_body_size 0;
+
+    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
+    chunked_transfer_encoding on;
+    ssl_protocols TLSv1.1 TLSv1.2;
+    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+
+   include /etc/nginx/snippets/letsencrypt.conf;
+
+    root /var/www/html/ ;
+   
+    location / {
+
+      proxy_set_header        Host $host;
+      proxy_set_header        X-Real-IP $remote_addr;
+      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header        X-Forwarded-Proto $scheme;
+  
+      proxy_pass ${REGISTRY_INTERNAL};
+      proxy_read_timeout                  900;
+    }
+
+}

gitlab-selfhosted/nginx/init.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+cd /etc/nginx/conf.d/
+
+VARIABLES='${HUB_INTERNAL}${DOMAIN}${LAB_INTERNAL}${REGISTRY_INTERNAL}'
+for i in *.template; do
+    target=$(basename $i ".template")
+    envsubst $VARIABLES < $i > $target;
+done || exit 1
+nginx -g 'daemon off;'

gitlab-selfhosted/nginx/snippets/letsencrypt.conf

@@ -0,0 +1,44 @@
+#############################################################################
+# Configuration file for Let's Encrypt ACME Challenge location
+# This file is already included in listen_xxx.conf files.
+# Do NOT include it separately!
+#############################################################################
+#
+# This config enables to access /.well-known/acme-challenge/xxxxxxxxxxx
+# on all our sites (HTTP), including all subdomains.
+# This is required by ACME Challenge (webroot authentication).
+# You can check that this location is working by placing ping.txt here:
+# /var/www/letsencrypt/.well-known/acme-challenge/ping.txt
+# And pointing your browser to:
+# http://xxx.domain.tld/.well-known/acme-challenge/ping.txt
+#
+# Sources:
+# https://community.letsencrypt.org/t/howto-easy-cert-generation-and-renewal-with-nginx/3491
+#
+#############################################################################
+
+# Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
+# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
+# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
+location ^~ /.well-known/acme-challenge/ {
+
+    # Set correct content type. According to this:
+    # https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/29
+    # Current specification requires "text/plain" or no content header at all.
+    # It seems that "text/plain" is a safe option.
+    default_type "text/plain";
+
+    # This directory must be the same as in /etc/letsencrypt/cli.ini
+    # as "webroot-path" parameter. Also don't forget to set "authenticator" parameter
+    # there to "webroot".
+    # Do NOT use alias, use root! Target directory is located here:
+    # /var/www/common/letsencrypt/.well-known/acme-challenge/
+    root         /var/www/letsencrypt;
+}
+
+# Hide /acme-challenge subdirectory and return 404 on all requests.
+# It is somewhat more secure than letting Nginx return 403.
+# Ending slash is important!
+location = /.well-known/acme-challenge/ {
+    return 404;
+}